- Shipped
- September 23, 2026 at 10:28 AM UTC
- Author
- Kamo
- Commit
- b69a594
CommissionService registers **************** directly with Stripe (OrgStripeSetupService), but no /api/commissions/** forward existed anywhere in this gateway -- every callback 404'd at the edge and commission payouts never reconciled against what Stripe actually settled. The same class of bug as the carrier SMS and checklist gaps already fixed here: a path this gateway does not forward is simply unreachable from the internet, and the failure is invisible from the far side. Added commission.service.url **************** confirmed against the live cluster with kubectl, port 80) and a forwardWebhook mapping for exactly **************** -- raw body and Stripe-Signature passthrough, no session or identity headers, the same shape as /api/billing/webhooks/stripe and /api/commerce/webhooks/**. Deliberately not a general /api/commissions/** wildcard: CommissionService's own InternalAuthFilter guards everything else on that service with only the shared X-Internal-Auth secret, the same trust boundary the /api/voip/sms/templates carve-out protects. CommissionWebhookForwardTest covers the mapping, that no wildcard leaks the rest of the service, and that the upstream request carries the exact body bytes and Stripe-Signature while a spoofed X-Org-Id, a guessed X-Internal-Auth, Authorization and Cookie are all absent. NOT FIXED HERE, and needs action in commission-service directly: CommissionService's InternalAuthFilter **************** documents that "/webhooks/stripe/** is NOT behind this filter" because Stripe cannot send an internal secret, but its actual PROTECTED_PREFIX is "/api/commissions" -- which the webhook path also starts with. The filter as written will 403 Stripe's own callback once it reaches this service, contradicting its own doc comment. It needs a carve-out (e.g. excluding paths starting with **************** before this forward is useful end-to-end.